Putting DORA into operation. With a CISO who keeps the evidence.

Not in substance. § 28 Abs. 6 Nr. 1 of the German BSIG exempts DORA financial entities from §§ 30, 31, 32, 35, 36, 38 and 39 BSIG: ICT risk management and incident reporting run under DORA via BaFin. What remains is registration under § 33 BSIG, provided your company counts as an essential or important entity under the BSIG; entity type and size thresholds decide that. DORA alone does not make a company an Annex 1 entity. Where the registration duty applies, the deadline is three months from the point the conditions are met. Management responsibility remains: DORA assigns it to the management body itself, including regular ICT risk training.

The vCISO leads the implementation of the information security obligations: ICT risk management, the incident process, the testing programme, oversight of ICT third-party providers and the evidence in OdySecure. Overall accountability stays with the management body. Legal classification and contract negotiations stay with your departments or your counsel.

EBA/CP/2025/12 (draft) is a consultation paper and outlines 19 fields, including: unique contract number, function, criticality, data flows, data location, subcontractor identity, contractual SLA, termination conditions, exit strategy. OdySecure contains a prepared outsourcing register with all 19 fields and AI support for contract analysis. The EBA published the final guidelines on 18 September 2026; the register is aligned with the consultation draft.

The BAIT, BaFin’s circular on IT requirements, are being phased out: BaFin removed DORA-covered financial entities from the BAIT scope as of 17 January 2025, and according to BaFin the remaining BAIT will be repealed step by step by the end of 2026. BaFin repealed the VAIT in January 2025. The MaRisk, BaFin supervisory expectations rather than a statute, remain in force. Your vCISO manages the information security requirements from DORA and MaRisk in OdySecure from a single control set; credit, market and liquidity risk stay with your risk controlling function.

If contracts exist digitally, typically 4 to 8 weeks to a fit-for-supervision register. The AI-supported contract analysis extracts EBA mandatory fields largely automatically, the compliance team verifies and supplements. Manual capture takes substantially longer.

Under a vCISO mandate from €3,600 per month, with OdySecure included. For a temporary gap, an Interim CISO typically costs €8,000 to €15,000 per month, project-based. Firms with their own CISO license the platform on its own from €12,900 per year; the tiers are on the pricing page. The initial call delivers a first cost estimate.